Dealing with Information Rights 


An agreed set of principles between the 
Public Services Ombudsman for Wales and the Information 
Commissioner’s Office. 


Background 


Every citizen has a right to request public information under the Freedom of 
Information Act 2000 (FOIA) or the Environmental Information Regulations 2004 
(EIR), and request access to their own personal data, by way of a subject access 
request, under the Data Protection Act 1998 (DPA). 


These are important rights. The right of access to public information in 
appropriate circumstances is key to making public bodies transparent and 
accountable. The subject access right is a practical expression of the 
fundamental right of an individual to respect for their private life. It is the 
Information Commissioner’s responsibility to promote and uphold these rights. 


These individual rights can, however, be constrained in so far as that is 
necessary to protect the rights and freedoms of others or on other important 
public interest grounds. FOIA and DPA therefore provide for the withholding of 
information where there is a properly applied legislative mechanism for doing so. 


The Ombudsman considers complaints of maladministration and service failure 
against public service providers in Wales under the Public Services Ombudsman 
(Wales) Act 2005 (PSOW Act). Additionally, the Ombudsman also considers 
complaints that members of local authorities have breached their Code of 
Conduct; these powers are set out in the Local Government Act 2000 (LGA) and 
associated regulations. 


The Ombudsman welcomes the rights of access set out in the Freedom of 
Information Act 2000, Data Protection Act 1998 and the Environmental 
Information Regulations 2004. At the same time the PSOW Act specifies that 
investigations must be conducted in private and there are restrictions imposed on 
the disclosure of information obtained in deciding whether to begin, or in the 
course of an investigation’. The Ombudsman also carries out Code of Conduct 
investigations in private, and the LGA contains specific restrictions on the 
disclosure of information obtained during such an investigation. The restrictions 
were imposed to ensure that the Ombudsman is able to carry out his statutory 
function efficiently and act as a necessary counterbalance to the wide powers of 
the Ombudsman to obtain information. 


* The PSOW Act includes other listed circumstances in which information has been obtained, which are also 
subject to restrictions on disclosure. 


The Information Commissioner and the Ombudsman recognise the 
complementary nature of their complaints handling functions and they are mindful 
of their experience of the provisions which allow the sharing of information 
between the two organisations, where it appears that the information relates to 
matters where the Information Commissioner or the Ombudsman has jurisdiction 
to enforce*. The Information Commissioner and the Ombudsman consider that 
this experience, as enshrined in statute, supports mutual co-operation between 
each other whilst the clarity afforded by the wording in the statue respects the 
unique responsibilities and particularities of each. 


This set of general principles has been drawn up to reflect the relative 
jurisdictions of the Ombudsman and the Information Commissioner's Office 
(ICO), and the interaction between the relevant legislation that comes into play 
when dealing with information rights. These interactions can be complex and this 
paper is not a comprehensive set of technical instructions but instead gives some 
context and agreed approaches to handling information requests. 


The legislative context 


Section 3 of the PSOW Act requires that any action taken in respect of the 
alternative resolution of a complaint must be in private. Where the Ombudsman 
investigates a complaint, section 13(2) of the PSOW Act specifies that the 
investigation must be conducted in private. Section 34X sets out the limited 
purposes for which information obtained by the Ombudsman in the discharge of 
these functions can be disclosed. In reference to Code of Conduct complaints, 
the restrictions are set out at section 63 of the LGA.. 


Members of the public can request information from public authorities under 
FOIA. Where there is an FOI request relating to an Ombudsman’s investigation 
then consideration has to be given to the operation of section 44 of FOIA. 
Section 44 provides that information is exempt information if any other enactment 
prohibits its disclosure. 


Requests for an individual’s own data, as opposed to public information or 
information relating to someone else, are made under the DPA. The application 
of the DPA and its interaction with both section 34X of the PSOW Act and section 
63 of the LGA is different to that of the FOIA. Section 27(5) of the DPA overrides 
the statutory bars in the PSOW Act and LGA. This means that personal data can 
only be withheld where a relevant DPA exemption applies. 


This does not mean, however, that all personal data has to be released under the 
provisions of the DPA as a matter of course. Section 31(4) of the DPA allows the 
Ombudsman to deny access to personal! data to the extent that providing access 
to that personal data would be likely to prejudice the proper discharge of his 
statutory functions. 


* Section 76(1) of the Freedom of Information Act 2000 and section 34X(2)(j) of the PSOW Act 


The Ombudsman has explained that if information from a complaint file is 
released under the DPA (when Ombudsman’s legislation makes clear that the 
Ombudsman’s investigations are undertaken in private and information should 
only be disclosed in very limited circumstances), the bodies investigated are likely 
to be less inclined to give all the information the Ombudsman needs in order to 
carry out his statutory functions effectively. 


Parliament accepted that there was a clear public interest behind the statutory 
bar — this led directly to the passing of section 31(4) of the DPA, and the 
existence of the statutory bar is a relevant factor in determining whether personal 
information should be released. In effect, section 31(4) helps the Ombudsman to 
carry out his functions in a manner that encourages people to provide him with 
the information he needs in order to investigate the complaints put to him. 


However, the existence of the ‘likely to prejudice’ test makes clear that this 
exemption does not operate as a blanket application covering all personal data in 
all Ombudsman’s investigations, and the exemption applies only in any case to 
the extent to which disclosure of the personal information to the data subject 
would be likely to prejudice the proper discharge of his functions. 


The Ombudsman must, therefore, balance his duty to operate openly and 
transparently, with his duty to act within the legislation that governs his work and 
to protect the privacy of personal and other information given to the Ombudsman 
in confidence. 


How the Ombudsman will handle information requests 


The Ombudsman will process information requests in line with the requirements 
of the FOIA, EIR and DPA while at the same time protecting information which 
should remain private, in line with the legislation that governs the Ombudsman’s 
work. In order to achieve this balance, the Ombudsman will take a three-step 
approach and consider all of the legislative requirements when handling 
information requests. Those three steps are: 


e Disclosure under the PSOW Act and/or LGA. 
e Disclosure under the FOIA (or EIR). 
e Disclosure under the DPA. 


The Annexes to these principles set out both how the Ombudsman will handle 
information requests in line with the relevant legislation and what the ICO will 
take into account when considering a complaint’s rights and the application of 
FOIA, EIR or DPA. 
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Annex A 
Disclosure by the Ombudsman under the PSOW Act and/or LGA 


The Ombudsman will consider whether the information requested can be 
released under his own legislation taking into account the following provisions: 


e Section 3(3) of the PSOW Act, which states that an action taken in respect 
of the alternative resolution of a complaint must be in private, and section 
13(2) which states that an investigation must be conducted in private. 


e Section 34X(2) of the PSOW Act which prevents information obtained by 
the Ombudsman or his officers in the circumstances set out in section 
34X(1) from being disclosed, unless disclosure is for one or more limited 
purposes. The most relevant of those purposes are likely to be for the 
purposes of deciding whether to begin an investigation; for the purposes of 
an investigation; and, for the purposes of a statement or a report made in 
relation to a complaint or an investigation). 


e Section 63(1) of the LGA which sets out the restrictions on the disclosure 
of information obtained during the course of a Code of Conduct 
investigation. 


Under the provisions of the legislation that governs the Ombudsman’s work, 
therefore, the information that can be disclosed about his investigations is limited. 
In practice, this means that information obtained in deciding whether to begin, or 
in the course of an investigation under the PSOW Act, or information obtained 
during the course of an investigation under the LGA, will be released when doing 
so is for the purposes of that investigation (for example, to make enquiries of the 
body complained about) or for the investigation report/decision letter. This 
ensures that a complainant sees the information (both personal and non- 
personal) which is material to the decision to enable the complainant to make 
representations about findings and recommendations (if any). This information 
may well go beyond the information that a requestor would be entitled to under 
the FOIA, DPA and EIR and may include, for example, information subject to 
legal privilege. Any information which has been obtained but which is not 
material to the Ombudsman investigation, report/decision letter will not be 
disclosed to the complainant. 


Annex B 


Disclosure by the Ombudsman under the Freedom of Information Act 2000 
or Environmental Information Regulations 2004. 


The Ombudsman will also consider whether the information requested can be 
released under FOIA (or the EIR). 


Section 44(1) (a) of FOIA exempts information from release if its disclosure is 
prohibited under any other enactment. Therefore, any information obtained by 
the Ombudsman in deciding whether to begin, or in the course of an investigation 
under the PSOW Act, or any information obtained during the course of an 
investigation under the LGA, and which falls, therefore, within the statutory bars 
at section 34X of the PSOW Act, or section 63(1) of the LGA, is exempt from 
disclosure under FOIA. This exemption is absolute - that is, it cannot be 
overridden whatever the public interest may be in any case in releasing the 
material concerned. 


In terms of considering an information request under the EIR, the Ombudsman 
will consider each case carefully taking into account any relevant exceptions 
(most notably section 12(4)(e) and section 12(5)(d)). (There are no ‘absolute’ 
exceptions in the EIR and the public interest will always need to be considered). 


Information Commissioner’s considerations under FOIA and EIR 


If an individual exercises their rights to approach the Information Commissioner 
then the Information Commissioner will consider the complaint. Where 
information has not been released under the FOIA an appropriate refusal notice 
will have been issued and the Ombudsman will be prepared to explain its position 
to the ICO with that in mind. 


The Information Commissioner will consider the nature of the request and the 
reasons for refusal, and take into account the application of section 44 of FOIA 
where appropriate. 


Information obtained by the Ombudsman for the purposes of or during the course 
of an investigation is caught by the statutory bar and cannot be disclosed for 
purposes other than that set out in the legislation. 


Information held by a public authority which emanates from the Ombudsman (that 
is, information that has been obtained by the Ombudsman for the purposes of or 
during the course of an investigation) is again caught by that Ombudsman’s 
statutory bar and cannot be disclosed. 


Information created by a public authority for the purposes of an investigation by 
the Ombudsman is also caught by the Ombudsman’s statutory bar. 


Information which is held by a public authority for the purposes of its own 
functions and is not caught by the provisions above, but which has been shared 
with the Ombudsman during the course of or for the purposes of an investigation, 
does not fall within the statutory bar and should therefore be disclosed or 
withheld by that public authority under a different provision in the FOIA. 


Disclosure by the Ombudsman under the Data Protection Act 1998 (DPA) 


The Ombudsman will also consider individual rights under the Data Protection 
Act taking into account any relevant exemption. 


It is noted that any information on an Ombudsman investigation file could be 
personal information, but not all information on an investigation file will 
necessarily fall into this category. 


As set out above, the need to protect the privacy of the investigation and ensure 
the efficient and effective exercise of his statutory functions, means that the 
Ombudsman will take decisions on disclosure under the DPA in light of the 
existence of an intention behind section 3, section 13 and section 34X of the 
PSOW Act, section 63 of the LGA, and section 7, section 27(5) and section 31(4) 
of the DPA. 


This does not mean that the Ombudsman does or will adopt a blanket approach 
to considering individual requests for information under the DPA or to applying 
section 31(4) of the DPA. Instead, the Ombudsman will consider carefully each 
individual case in order to ascertain whether there is a particular reason, in that 
case, for overriding the individual's right of access by maintaining the statutory 
bar and withholding personal information (not already disclosed for the purposes 
of his investigation). 


If the Ombudsman concludes that section 31(4) of the DPA is applicable, the 
Ombudsman will need to be specific in identifying/describing the 
classes/categories of documents that are, in its view, exempt from disclosure and 
then explain why section 31(4) is applicable to those classes of documents. 
Careful consideration to identify personal data will need to be carried out to 
satisfy the requirements of the subject access provisions under both the DPA and 
the Ombudsman’s legislation, but the Ombudsman does not need to adopt a 
document by document or line by line explanation to the ICO. 


Information Commissioner’s considerations under the Data Protection Act 
1998 (DPA) 


Where an individual seeks an assessment from the ICO following a subject 
access request (or indeed any other alleged non-compliant processing), under 
section 42 of the DPA, the ICO will be considering the application of the Act and 
adherence to the data protection principles. 


It is therefore important to make sure that enough information is provided with 
regard to the application of section 31 when withholding personal data. It should 
be remembered that the ICO, when carrying out an assessment, is considering if 
the principles of the Act are being applied and whether ultimately a breach of the 
Act is likely or unlikely. This may stop short of actually defining which pieces of 
personal data (if any) should be released but any explanation, both to the 
complainant and the ICO, will need to be sufficiently detailed to allow the 


assessment to be carried out from an informed point of view. As the application 
of section 31(4) of the DPA effectively curtails what would otherwise be the rights 
of individuals under the Act, the ICO needs to be satisfied that where this 
exception is relied upon, it is supported by reasonable argument rather than by 
the application of a blanket approach so that all parties are aware of the extent to 
which disclosure would be likely to prejudice to statutory functions. 


